changed 3 months ago
Published Linked with GitHub

Gateway API: cool, but why can't I configure TLS myself?

Image Not Showing Possible Reasons
  • The image was uploaded to a note which you don't have access to
  • The note which the image was originally uploaded to has been deleted
Learn More →

Maël Valais, 21 May 2025


Why care about Gateway API?

  1. Gateway API = role-aware version of Ingress API + many more knobs and less annotations
  2. Ingress API not well defined, e.g., one team may silently be claiming traffic from another team's hostname
  3. nginx-ingress obsolescent: no new feature, will be deprecated by 2026

Today: no more TLS self-service with Gateway API

Ingress dev configures routes + TLS
Gateway costly shared resources owned by cluster operator = dev can't configure TLS

Tomorrow: ListenerSet + cert-manager = back to self-service TLS (GEP 1713)


gateway-with-manifests.excalidraw-fs8


gateway-listenerset-manifests.excalidraw-fs8


tl;dr:

  • Thousands of users stuck with Ingress due to cert-manager
  • Work with sigs-network on a good migration (implement ListenerSet + improve ingress2gateway)

qrcode_hackmd.io-fs8

Select a repo